The practice has alarmed privacy advocates, and giving out Facebook login information also violates the social network's terms of service. But those terms have questionable legal weight, and experts say the legality of asking for such information remains murky.